Privacy Policy

1. Data fiduciary

[Company Legal Name] ("we", "us", "our") operates the BotWorks software-as-a-service platform (the "Service"). For personal data processed through the Service, we act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

• Registered address: [Registered office address, City, State, PIN Code, India]
• Privacy contact: [privacy@yourcompany.com]
• Grievance officer: [grievance@yourcompany.com] (see Section 12)

2. Scope

This policy applies to personal data we process about account holders and their authorised users who sign up for BotWorks, use our website, or contact us. It also describes categories of data our customers process about their end users (for example WhatsApp contacts and message content) when using automation, inbox, flows, and bulk messaging features.

When our customers use BotWorks to message their own customers, those customers may act as data fiduciaries for their end users' data. We process such data on their instructions as a data processor to deliver the Service.

3. Categories of personal data we collect

3.1 Account and identity data

• Name, email address, and password (stored as a one-way hash).
• Optional profile fields you provide (for example university, degree, branch) and profile image if you use Google sign-in.
• Email verification data: one-time passwords (OTP) and verification tokens during registration.
• Password reset tokens when you request a reset.

3.2 Authentication and session data

• Session identifiers and OAuth account linkage when you sign in with email/password or Google (NextAuth).
• HTTP-only session cookies required to keep you signed in.

3.3 Workspace and configuration data

• Workspace (tenant) name, membership roles, and audit logs of actions you take in the dashboard.
• WhatsApp Business account identifiers, display phone numbers, business names, and encrypted Meta Cloud API access tokens you connect.
• Flow definitions, keyword rules, templates, integration settings, and optional AI features settings (including API keys you choose to store).

3.4 Messaging and contact data (processed for your use of the Service)

• WhatsApp contact identifiers, phone numbers, profile names, tags, and custom attributes you or your automations store.
• Conversation and message content (text and metadata), delivery status, provider message IDs, and related webhook payloads from Meta.
• Automation logs (incoming/outgoing text snippets, matched rules, errors) and bot session state.
• Bulk campaign recipient lists (phone numbers and optional names) and send status you upload or enter.

3.5 Communications with us

• Name, email, subject, and message content when you submit our contact form.

3.6 Technical data

• Standard server and application logs (for example IP address, request timestamps, error traces) for security and reliability.
• Theme preference stored in your browser's local storage (not used for advertising).

We do not use third-party advertising or analytics cookies on the Service as described in our Cookie Policy.

4. Purposes and legal basis

We process personal data only for specified, legitimate purposes, including:

• Providing the Service: account creation, authentication, WhatsApp Cloud API connectivity, inbox, flows, keyword automation, bulk campaigns, and related support.
• Security and integrity: fraud prevention, rate limiting, webhook verification, encryption of secrets, and audit logging.
• Communications: sending OTP and transactional emails (registration, password reset) and responding to contact form inquiries.
• Legal and compliance: record-keeping, responding to lawful requests, and enforcing our terms.

Under the DPDP Act, we rely primarily on your consent (for example when you create an account and accept this policy) and on processing that is necessary for the provision of the Service you request. Where you configure automations or bulk messages, you are responsible for obtaining valid consent or another lawful basis from your recipients under applicable law, including Meta's WhatsApp Business policies.

5. Purpose limitation and data sharing

We do not sell personal data. We share data only as needed to operate the Service, including with:

• Meta Platforms, Inc. (WhatsApp Cloud API) — to send and receive business messages and receive delivery and webhook events, subject to Meta's terms and privacy notices.
• Google LLC — if you choose "Continue with Google" for authentication.
• Email delivery — transactional email via our configured SMTP provider (for example Gmail SMTP when enabled in our environment).
• Infrastructure providers — hosting and database services that store encrypted data at rest and process it to run the application (for example PostgreSQL and our cloud host).
• Optional AI providers — only if you enable AI features and supply an API key; message content needed for a reply may be sent to that provider under your configuration.

We require processors to handle data only on our instructions and implement appropriate security measures consistent with this policy.

6. Cross-border transfers

Personal data may be processed or stored on servers located outside India, including where Meta, Google, or our hosting provider operate data centres (for example in the United States or other jurisdictions). Where the DPDP Act requires safeguards for such transfers, we implement contractual and technical measures appropriate to the nature of the processing and will update this section as applicable rules and certifications evolve.

7. Retention

We retain personal data only as long as necessary for the purposes above, including:

• Account data: for the life of your account and for a reasonable period after closure to resolve disputes, enforce terms, and meet legal obligations.
• OTP and verification records: until verification completes or expiry, then deleted or anonymised.
• Messages, contacts, campaigns, and logs: while your workspace uses the Service and according to your operational needs; you may delete or update much of this data through the product. Backups may persist for a limited period for disaster recovery.
• Contact form submissions: as long as needed to respond and maintain a record of correspondence.

We may retain anonymised or aggregated data that no longer identifies you.

8. Security

We use administrative, technical, and organisational measures designed to protect personal data, including password hashing, AES-256-GCM encryption for stored WhatsApp access tokens, HTTPS in production, access controls on workspaces, and webhook signature verification where configured. No method of transmission or storage is completely secure; please use a strong password and protect your Meta credentials.

9. Your rights under the DPDP Act

Subject to the DPDP Act and applicable exceptions, Data Principals may have the right to:

• Obtain a summary of personal data processed and the identities of other fiduciaries/processors with whom data has been shared.
• Request correction, completion, updating, or erasure of personal data.
• Withdraw consent where processing is consent-based (withdrawal does not affect prior lawful processing).
• Nominate another individual to exercise rights in the event of death or incapacity, as permitted by law.
• Lodge a grievance with us and, if unresolved, with the Data Protection Board of India as established under law.

To exercise rights, email [privacy@yourcompany.com] from your registered account email. We may verify your identity before acting on a request.

10. Children's data

The Service is intended for businesses and users who are at least 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected a child's data, contact us at [privacy@yourcompany.com] and we will take steps to delete it.

11. Changes to this policy

We may update this policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes may be communicated via the Service or email where appropriate. Continued use after changes take effect constitutes acknowledgment of the updated policy where permitted by law.

12. Grievance redressal

In accordance with the DPDP Act, you may contact our Grievance Officer for concerns about our processing of your personal data:

• Name: Grievance Officer, [Company Legal Name]
• Email: [grievance@yourcompany.com]
• Address: [Registered office address, City, State, PIN Code, India]

We aim to acknowledge grievances promptly and resolve them within timelines prescribed under applicable law.